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INTELLECTUAL PROPERTY RIGHTS 



FIELD OF THE INVENTION 

5 The present invention relates to networks in general, and to 

methods and systems for preventing intellectual property rights 
infringement of computer objects, in particular. 



BACKGROUND OF THE INVENTION 

10 The use of Internet by the general public, and with it the World 

Wide Web, is growing at an exponential rate. According to an NUA survey, 
as of July 2000, there were 333 million users world wide. A large 
percentage of these users regularly post on the Internet, electronic objects 
or a part thereof, such as software, surveys, pictures, music, films, 

15 animations, novels, poems and research reports. Some of these items are 
intellectual property and are protected by intellectual property legislation, 
such as copyright, Trademarks, patents, and the like. 

Methods and systems which try to circumvent the problem of 
copyright infringement, are known in the art. Some of these methods 

20 employ encryption as a means to prevent the use of copyright material by 
unauthorized persons. Others employ public-private keys, passwords or 
embedded electronic signatures. A musical band, called Bare Naked 
Ladies distributed files bearing the names of their own music tracks in the 
Napster network, and attached a warning statement to each of these files, 

25 which notified the user that she is infringing Intellectual Property (IP) 
protected rights. 

US Patent No. 6,119,108 entitled "Secure Electronic Publishing 
System" issued to Holmes et at., is directed to a method for charging a 
user for the use of an electronic object through the Internet. When the user 
30 attempts to open the object, access to the object is interrupted and she is 
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connected with the purchasing authority system, to conduct a financial 
transaction therewith. If the user is interested in opening the electronic 
object, she supplies her personal information such as name, address, and 
telephone number, as well as payment information such as credit card 

5 information. Then the user is given a password to access the object. Other 
users can likewise gain access to the object by obtaining a personal 
password from the purchasing authority system. Hence, only those users 
who have arranged payment, can access a specific object on the Internet. 

US Patent No. 5,987,126 issued to Okuyama et al., and entitled 

10 "Device Having a Digital Interface and a Network System Using Such a 
Device and a Copy Protection Method", is directed to a method for 
controlling the recording of sound or video, according to copy generation 
management information. A first and a second sending (reproduction) 
device are connected to a receiving (recording) device, via an IEEE 1394 

15 standard bus. 

The first sending device includes a reproduction processing 
circuit, a D-interface format output processing circuit, an IEEE 1394 
interface and a copy flag detecting circuit. The D-interface format output 
processing circuit, the IEEE 1394 interface and the copy flag detecting 

20 circuit are interconnected. The reproduction processing circuit is 
connected to a reproduction device and to the D-interface format output 
processing circuit. The second sending device includes a decoding circuit, 
an MPEG output processing circuit, an IEEE 1394 interface and a copy 
flag detecting circuit. The MPEG output processing circuit, the IEEE 1394 

25 interface and the copy flag detecting circuit are interconnected. The 
decoding circuit is connected to a reproduction device and to the MPEG 
output processing circuit. 

The receiving device includes a IEEE 1394 interface, a format 
converting circuit, a recording processing circuit, a copy generation circuit 

30 and a recording controlling circuit. The IEEE 1394 interface includes a 
copy flag detector. The copy flag detector is connected to the copy 
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generation circuit and to the recording controlling circuit. The recording 
processing circuit is connected to the recording controlling circuit and to 
the format converting circuit. The format converting circuit is connected to 
the copy generation circuit and to the IEEE 1394 interface. The IEEE 1394 
interfaces of the first and the second sending devices are connected to the 
IEEE 1394 interface of the receiving device via the IEEE 1394 bus. 

The copy flag detecting circuit of the first and the second device 
detects the copy generation management information embedded in the 
source control packet, and sends this information to copy flag detector of 
the receiving device via the IEEE 1394 interface. For example, if the copy 
generation management information detected by the copy flag detector is 
"11", which prohibits copying, then the recording processing circuit of the 
receiving device controls the operation of the servo circuit, so as to omit 
recording. 

US Patent No. 5,867,579 issued to Saito and entitled "Apparatus 
For Data Copyright Management System", is directed to a system to 
manage data which are protected by copyright. The system includes a key 
control center connected to a read only memory (ROM), a read and write 
memory (RAM) and to an electrically erasable programmable read only 
memory (EEPROM) via a local bus. The system bus of a user terminal is 
connected to the local bus of the system. The user terminal includes an 
MPU connected to a communication unit (COMM), a CD-ROM drive 
(CDRD), a flexible disk drive (FDD) and to a hard disk drive (HDD), via the 
system bus. 

Fixed information such as data copyright management program, 
a cryptography program, user data, a decryption program, a re-encryption 
program and a program for generating secret keys are stored in the ROM. 
A crypt key and the copyright information are stored in the EEPROM. 
Either one of the first crypt-key or the second crypt-key and data copyright 
management system program are stored in the RAM of the system and in 
the RAM of the user terminal. 
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A primary user receives the first secret-key as a decryption key 
and the second secret-key as an encryption/decryption key. The encrypted 
original data is decrypted using the first secret-key. When the data is 
stored in a memory or in a hard disk drive, only the primary user can use 

5 the data. When the original data or the edited data is stored in the memory 
of the primary user terminal, only the primary user can use the data. When 
the original data is copied and supplied to a secondary user, the copyright 
of the primary user is not affected on the original data. 

When the primary user produces an edited data by editing the 

10 original data or combining the original data with other data, the secondary 
exploitation right of the primary user (i.e., the copyright of the primary user) 
is affected. The primary user, then requests a second-key from the key 
control center. Thereafter, the primary user decrypts and encrypts the 
data, using the secondary secret-key. Similarly, when the secondary user 

15 produces an edited data from the original data, or edits the data obtained 
from the primary user, the copyright of the secondary user is affected. The 
secondary user can use the data, by designating the original data name or 
data number, the secondary user information and the unencrypted primary 
user information to the copyright management center. The copyright 

20 management center confirms that the primary user has received the 
second secret-key, and then transfers the second secret-key to the 
secondary user. 

US Patent No. 5,790,236 issued to Hershtik et al., and entitled 
"Movie Processing System", is directed to a method and a system for 

25 modifying the soundtrack or the picture frames of a video, by producing 
respective sound and frame characteristics. Initially, different versions of a 
movie are entered to the system. The resolution of each version is 
reduced, for each version a plurality of sound characteristics and frame 
characteristics are produced and these characteristics are stored in a 

30 memory. A movie version synchronizer analyzes the frame characteristics 
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and produces indications of all the movie versions for which different 
movie segments appear. 

An output movie editing list generator produces an editing list 
such as "intersection", "union" or "complement to reference", according to 

5 the output of the movie version synchronizer. An icon incorporation unit 
can use the "complement to reference" list to incorporate an icon with the 
frames, to indicate the language version of the movie. A reduced 
resolution video editing workstation employs the "intersection" editing list 
of the output movie editing list, to provide a high resolution video editing 

10 workstation, with the same movie segments which appear in different 
languages. The high resolution video editing workstation produces an 
output movie which includes a single video track and a plurality of 
soundtracks in different languages. 

US Patent No. 5,892,825 issued to Mages et al, and entitled 

15 "Method of Secure Server Control of Local Media Via a Trigger Through a 
Network for Instant Local Access of Encrypted Data on Local Media", is 
directed to a method to enable reading of a CD-ROM whose reading had 
been previously disabled. A user is originally supplied with a crippled CD- 
ROM whose audio/video header is removed, thus preventing the computer 

20 of the user to read these audio/video data. The crippled CD-ROM includes 
the uniform resource locator (URL) of the web site which can provide the 
user with a de-crippling key. The user initiates a socket-to-socket 
connection between her computer and the server of the web site, and the 
de-crippling key is transmitted to the computer and stored in the RAM 

25 thereof. In RAM, the de-crippling key and the data of the CD-ROM are 
combined, thereby enabling the playback of the audio/video data. 

US Patent No. 5,787,068 issued to Arps et al., and entitled 
"Method and Arrangement for Preventing Unauthorized Duplication of 
Optical Discs Using Barriers", is directed to a method for preventing 

30 unauthorized copying of data recorded on optical discs, such as CD-ROM. 
In a conventional CD-ROM, data is recorded contiguously in a spiral track. 
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According to this patent, gaps and barriers or decoy files are placed 
between real data files and a directory is recorded at the beginning of the 
spiral track, which includes pointers to each of the real files. An optical 
reading head which attempts to read the data, derails from the track when 
it discovers these gaps and barriers, and thus unauthorized reading of 
data is prevented. Authorized reading is facilitated by the pointers of the 
directory which instruct the reading head to read the data files non- 
contiguously. 

US Patent No. 5,923,763 issued to Walker et al., and entitled 
"Method and Apparatus for Secure Document Timestamping", is directed 
to a method and a system to prevent forging of documents, by generating 
a timestamp for the document. The system includes a cryptographic 
processor, a random number generator, a clock, a signal receiver, an 
internal power source, a RAM memory and a non-volatile memory 
interconnected via a bus. The system is connected to an input device, 
such as a push button, an output device, such as a printer and to an 
external power source, via the bus. The clock is either internal or external, 
such as the timing signal of a global positioning system (GPS) and the US 
Observatory atomic clock. 

The system creates a timestamp according to a request from the 
input device and outputs the timestamp to the output device. The 
cryptographic processor generates a timestamp from the clock and 
outputs the timestamp consisting of the cleartext time, plus a one way 
function which represents the time. The one way function can be a hash, a 
message authenticity code (MAC) and a cyclic redundancy check (CRC). 
The one way function allows one to determine if the document has been 
tampered. The hashing algorithm can be stored either in the RAM or in the 
non-volatile memory. 

The user produces a chained hash for the document, whose 
timestamp includes for example, three consecutive dates. If a forger 
discovers the private key of the user and alters the timestamp of one of 
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these dates, then the user can recompute the subsequent three 
timestamps and compare them with their known values. If the known and 
the computed timestamp disagree, then the user can determine that the 
timestamp of one of these dates has been altered. The forger can change 

5 all the timestamps in the chained hash, but this requires more effort than 
changing the desired one, and also increases the chances of detection. 
The random number generator generates random numbers to prevent 
generation of reused timestamps. 

US Patent No. 6,047,242 issued to Benson, and entitled 

10 "Computer System for Protecting Software and a Method for Protecting 
Software", is directed to a method for purchasing software which is 
protected by electronic copy and license protection (ECP). The customer 
downloads a protected software from the vendor, the customer sends a 
registration package to the vendor, and the vendor generates a keyfile for 

15 the customer and sends the keyfile to the customer. 

A challenge mechanism is embedded in the protected software, 
such that an attacker can not easily separate the challenge mechanism 
from the protected software. The public keying material of the vendor is 
embedded in the challenge mechanism. The vendor signs both the 

20 protected software and the challenge mechanism, using her private key. 
The registration package includes a reference to a public directory which 
holds the public keying material of the customer. 

The keyfile includes the public keying material of the customer 
along with thousands of decoy bits. The customer information is 

25 embedded in the keyfile, in encrypted form, while the encryption key is not 
disclosed. The vendor can identify the owner of the keyfile, when the 
keyfile appears in a public location, such as a bulletin board. The vendor 
signs the keyfile, by employing a keyfile generator, the private keying 
material of the vendor and by applying a digital signature algorithm. When 

30 the customer installs the keyfile, the challenge mechanism allows the 
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customer to execute the protected software, if the customer can prove that 
she has access to the private keying material of the customer. 
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SUMMARY OF THE PRESENT INVENTION 

It is an object of the present invention to provide a novel method 
and system for preventing the infringement of intellectual property rights, 
which overcomes the disadvantages of the prior art. In accordance with 
5 one aspect of the present invention, there is thus provided a searching 
server for identifying an infringing item in a network. The searching server 
includes a sniffing user and a characteristics database. The sniffing user is 
connected to the network and the characteristics database is connected to 
the sniffing user. 

10 The characteristics database includes Intellectual Property (IP) 

item characteristics of IP items. The sniffing user detects an infringing item 
using a directory available on the network. The sniffing user retrieves 
infringing item charac teristics from the network. The searching server 
identifies the infringing item, by comparing the infringing item 

15 characteristics with the IP item characteristics. 

In accordance with another aspect of the present invention, 
there is thus provided a system for producing IP item modified copies. The 
system includes a network interface and a processor. The network 
interface is connected to a network and to the processor. The processor 

20 produces modified copies from IP items and the modified copies are made 
available to the network via the network interface. 

In accordance with a further aspect of the present invention, 
there is thus provided a modified item. The modified item includes 
modified item characteristics and modified item content. The modified item 

25 is produced according to at least one item characteristics, item content 
and supplementary material. 

In accordance with another aspect of the present invention, 
there is thus provided a system for sharing items in a network. The system 
includes at least one storage unit for storing modified copies of a plurality 

30 of items and at least one network interface connected to one of the 
storage units and to the network. Each network interface is associated with 
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a different selection of modified copies. Each network interface shares the 
modified copies associated therewith, over the network. 

In accordance with a further aspect of the present invention, 
there is thus provided a method for reducing the probability for identifying 
an item in a network. The method includes the steps of associating a 
plurality of network interfaces with modified copies of items and enabling 
the availability of the modified copies through the network interfaces. 

In accordance with another aspect of the present invention, 
there is thus provided a method for detecting an infringing copy of an IP 
item in a network. The method includes the steps of inspecting a search 
result for identifying the infringing copy and comparing at least one 
infringing copy characteristic of the infringing copy, with at least one IP 
item characteristic of the IP item, when the infringing copy is identified. 
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BRIEF DESCRIPTION OF THE DRAWINGS 

The present invention will be understood and appreciated more 
fully from the following detailed description taken in conjunction with the 
drawings in which: 

Figure 1 is a schematic illustration of an item sharing server, 
constructed and operative in accordance with a preferred embodiment of 
the present invention; 

Figure 2 is a schematic illustration of a production server, 
constructed and operative in accordance with another preferred 
embodiment of the present invention; 

Figure 3 is a schematic illustration of a computer system, 
constructed and operative in accordance with a further preferred 
embodiment of the present invention; 

Figure 4A is a schematic illustration of an item sharing server, 
constructed and operative in accordance with another preferred 
embodiment of the present invention; 

Figure 4B is a schematic illustration of an item sharing server, 
constructed and operative in accordance with a further preferred 
embodiment of the present invention; 

Figure 5 is a schematic illustration of an item sharing server, 
constructed and operative in accordance with another preferred 
embodiment of the present invention; 

Figure 6 is a schematic illustration of a method for proliferating 
unusable copies of an item in a network, operative in accordance with a 
further preferred embodiment of the present invention; 

Figure 7 is a schematic illustration of step 400 of Figure 6, 
operative in accordance with another preferred embodiment of the present 
invention; 

Figure 8 is a schematic illustration of a computer system, 
constructed operative in accordance with a further preferred embodiment 
of the present invention; 
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Figure 9 is a schematic illustration of a computer system, 
constructed operative in accordance with another preferred embodiment of 
the present invention; and 

Figure 10 is a schematic illustration of a computer system, 
constructed operative in accordance with a further preferred embodiment 
of the present invention. 
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DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS 

The present invention overcomes the disadvantages of the prior 
art by providing a system and a method which reduce the probability of 
accessing an intellectual property (IP) infringing object, on an information 
network, by distributing a large number of modified mockup copies of that 
IP infringing object, bearing the same characteristics. Accordingly, a user 
searching for the IP infringing object would receive a search list which 
includes a large number of the modified mockup copies and may also 
include the IP infringing object, from which the user selects an object to 
download. Provided that the modified mockup copies outnumber the 
copies of the IP infringing object, available on the network, then the 
probability of downloading the IP infringing object and not one of the 
modified mockup copies shall be significantly low. This low probability may 
discourage the user from downloading after a few unsuccessful attempts. 

The term "IP protected item" herein below, refers to an item 
protected by copyright or other intellectual property rights, for which a user 
owns a valid license on behalf of the owner of the item, to use the item. 
The term "infringing item" herein below, refers to an item or an object, 
which incorporates intellectual property rights, that may be infringed by the 
user which makes that item available on the network. 

The term "supplementary material" herein below, refers to a 
portion of a media object or a collection of such portions, which is included 
in a modified item. The supplementary material can be an advertisement, 
a commercial promotion, a movie trailer, a link to legitimate sites, a 
warning statement which states that the downloaded object incorporates 
proprietary intellectual property rights, and the like, or a combination 
thereof. The warning statement can be in the form of text, graphics, video, 
animation, sound, and the like, or a combination thereof. 

The term "usable" herein below, refers to an item whose content 
can be properly and entirely comprehended by a person to her 
satisfaction, when she opens the item on her user terminal and interacts 
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therewith, using at least one of the five senses. The term "unusable" 
herein below, refers to an item whose content can not be properly and 
entirely comprehended or utilized by the person to her full satisfaction, 
when she attempts to interact therewith. An item can be rendered 
unusable, for example if it is a video, by changing the original sequence of 
the scenes. Thus, although the content of the unusable copy is identical 
with the content of the usable one, the person will not comprehend the 
theme of the video, even after viewing the entire unusable copy. 

Reference is now made to Figure 1, which is a schematic 
illustration of an item sharing server, generally referenced 100, 
constructed and operative in accordance with a preferred embodiment of 
the present invention. Searching server 100 includes a sniffing user 102, a 
characteristics database 104, a signature database 106 and a content 
database 108. Sniffing user 102 is connected to a network 116, 
characteristics database 104 and to signature database 106. 
Characteristics database 104 and signature database 106 are connected 
to content database 108. 

Searching server 100, a user 110, a share-infringing user 112 
and a directory 114 are connected to network 116, by a wired or wireless 
link, or a combination thereof. Network 116 is a publicly accessed network 
(e.g., the Internet) or network application (e.g., Napster, Gnutella, Scour, 
Freenet, imesh, and the like). Directory 114 is either a central directory or 
a distributed directory, spreading over a plurality of nodes in network 116. 
User 110 and share-infringing user 112 are workstations, desktops, 
laptops, mobile units, network user applications, and the like. 

Users which are connected to network 116, can download items 
from one another. Each of these users can download an item from another 
user either directly (peer to peer), or indirectly through a mediator (e.g., 
through directory 114). For example, user 110 can download an infringing 
ITEM-2 118 2 from share-infringing user 112, thereby infringing intellectual 
property rights. Share-infringing user 112 can infringe IP rights by sharing 

-14- 



infringing ITEM-2 118 2 with other users (not shown) and also by 
downloading other infringing items (not shown) from these other users. 

A digital item is a digital entry, file, or object which can be 
processed by user 110, share-infringing user 112 and searching server 
100 and downloaded from one user to another, either directly, or via a 
mediating node. A digital item can be in a format known in the art, such as 
MIDI, WAV, AVI, MPEG, JPEG, ASCII, TIFF, GIF, PDF, RTF, bitmap, and 
the like, or a combination thereof. 

Share-infringing user 112 includes a plurality of items: ITEM-1 
118-,, ITEM-2 118 2 and ITEM-N 118 N . ITEM-2 118 2 is an infringing copy of 
ITEM-2 120 2 . User 110 includes a plurality of IP protected items: ITEM-1 
120!, ITEM-2 120 2 and ITEM-K 120 K . The content of infringing ITEM-2 
118 2 and IP protected ITEM-2 1 20 2 is substantially identical, while their 
format may be different. Thus, share-infringing user 112 can download IP 
protected ITEM-2 1 20 2 from user 110 and store it in share-infringing user 
112 as infringing ITEM-2 118 2 , without obtaining a license to use IP 
protected ITEM-2 1 20 2 . 

When user 110 and share-infringing user 112 are both 
connected to network 116, share-infringing user 112 requests directory 
114 to search for ITEM-1 120-1, while a downloading application runs in 
both user 110 and share-infringing user 112. Directory 114 provides share- 
infringing user 112 with search results. The search results indicate that 
ITEM-1 120-1 resides in user 110. Share-infringing user 112, then 
downloads ITEM-1 120i from user 110. 

Content database 108 includes the content (e.g., audio, video, 
software, computer games, data, e-books, and the like) of a plurality of IP 
protected items (e.g., copyright protected items). Signature database 106 
includes the signature of each of the IP protected items residing in content 
database 108. 

A signature is uniquely derived from the item, its content or 
characteristics. An example for such a signature is hereby described in 
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conjunction with digital video in MPEG format. The signature is produced 
as a sequence of numbers, from the l-Frames (i.e., intra-frame). Each of 
the numbers in the sequence is calculated according to a given function 
on predetermined areas in a selected l-Frame. In case of analog video in 
other formats, such as PAL, SECAM, NTSC, and the like, the signature is 
produced from a plurality of frames, which indicate a significant change in 
the visible content, such as a new video shot. Thus, a signature indicates 
the content of an item, while occupying a volume substantially smaller than 
the item itself. Similar signatures can be produced for audio and other 
media types. Characteristics database 104 includes the characteristics of 
each of the IP protected items stored in content database 108. The 
characteristics are the metadata of an item, such as title, file size, 
category, date of production, producer, performer, and the like. 

Searching server 100 is a repository of a plurality of items, 
whose contents are stored in content database 108. Searching server 100 
is either the owner of these items, or is authorized by the owner of these 
items, to take certain actions concerning these items. These actions can 
include modifying the item, uploading the modified item to a third party, 
making a plurality of the modified item available to the public, and the like. 
The address of each of the users who owns an IP protected item can be 
stored in searching server 100 (e.g., incorporated with characteristics 
database 104). Thus for example, searching server 100 can include the 
information that user 110 is the owner of IP protected ITEM-1 120) and 
ITEM-2 1 20 2 , and that any copy of these items retrieved from address of 
user 110 are legitimate copies. Accordingly, server 100 can refrain from 
taking measures regarding the presence of ITEM-1 120! and ITEM-2 120 2 
and their availability via user 110, provided that user 110 has the right to 
share the items. 

Sniffing user 102 retrieves selected characteristics of an IP 
protected item, from characteristics database 104. Sniffing user 102 
retrieves for example, the following characteristics from characteristics 
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database 104, for ITEM-2: "Donald Duck in Jail" for the title, "Walt Disney 
Productions" for the producer and "Video" for the type of the item. 

Sniffing user 102 then searches for an infringing copy of ITEM-2 
in network 116, by producing a query according to the selected 
characteristics of ITEM-2 and providing that query to directory 114. This 
process can be fully automated. Directory 114 provides search results 
respective of the query. The search results indicate that ITEM-2 118 2 and 
ITEM-2 120 2) whose characteristics are similar to the selected 
characteristics, reside in user 110 and share-infringing user 112, 
respectively. Sniffing user 102 determines that ITEM-2 118 2 is an 
infringing copy of ITEM-2. 

For increasing the certainty that ITEM-2 118 2 is indeed 
infringing, sniffing user 102 performs a verification procedure. Sniffing user 
102 downloads at least a portion of infringing ITEM-2 118 2 to a storage 
unit (not shown) located in searching server 100 and compares the 
content of the downloaded item with a reference item, which is suspected 

of being infringed. 

For this purpose, searching server 100 produces a signature for 
the downloaded infringing ITEM-2 118 2 . It is noted that the signatures of 
items bearing identical content, but being in different formats, is essentially 
identical. For example, searching server 100 produces the same signature 
for a copy of "Donald Duck in Jail" video in MPEG version, PAL version 
and NTSC version. Searching server 100 produces a signature for the 
downloaded infringing ITEM-2 11 82 and retrieves the signature of ITEM-2 
from signature database 106. Searching server 100 compares the 
produced signature of infringing ITEM-2 118 2 with the retrieved signature 
of ITEM-2. If all or a part of the two signatures are identical, then 
searching server 100 saves the characteristics of infringing ITEM-2 118 2 . 

Reference is now made to Figure 2, which is a schematic 
illustration of a production server, generally referenced 150, constructed 
and operative in accordance with another preferred embodiment of the 
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present invention. Production server 150 includes a virtual user 152, a 
modified ITEM-2 154, a processor 156 and an IP protected ITEM-2 158. 
Virtual user 152 is connected to network 116 and to modified ITEM-2 154. 
User 110, share-infringing user 112, directory 114, a translator 160 and 
production server 150 are connected to network 116. Alternatively, virtual 
user 152 can be a network interface, a sharing user, and the like. 

Translator 160 is an application, such as a web site, plug-in, and 
the like. Alternatively, translator 160 resides in user 110, share-infringing 
user 112 and in production server 150. Translator 160 produces a unique 
name for an item, according to the characteristics of the item, by 
employing a random key. 

Processor 156 produces modified ITEM-2 154 by processing IP 
protected ITEM-2 158. Alternatively, processor 156 produces modified 
ITEM-2 154 by processing infringing ITEM-2 118 2 . Modified ITEM-2 154 is 
an unusable copy of IP protected ITEM-2 158 (or infringing ITEM-2 118 2 ) 
having substantially the same characteristics (e.g., file name, file size, file 
type) as those of IP infringing ITEM-2 11 8 2 . Thus, when user 1 1 0 searches 
network 116 for a copy of ITEM-2, it obtains search results which include 
infringing ITEM-2 118 2 and modified ITEM-2 154. 

Directory 114 provides user 110 with information respective of 

the characteristics of infringing ITEM-2 118 2 and modified ITEM-2 154, 

such as title, file size, producer, and the like. However, because the 

characteristics of both infringing ITEM-2 118 2 and modified ITEM-2 154 

are substantially the same, user 1 10 can not differentiate between the two, 

according to the information which it receives from directory 114. 

Modified ITEM-2 154 can include out-of-sequence segments of 

IP protected ITEM-2 158 (or infringing ITEM-2 118 2 ), separated by one or 

more items of supplementary material. Alternatively, modified ITEM-2 154 

can include out-of-sequence segments of IP protected ITEM-2 158, 

followed by one or more items of supplementary material. Further 

alternatively, the first portion of modified ITEM-2 154 can be a substantially 
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small portion of the beginning of IP protected ITEM-2 158 and the rest of 
modified ITEM-2 154 can include recurring items of supplementary 
material. For example, if modified ITEM-2 154 is a video, it includes the 
first ten minutes of the original (IP protected) video, while the remainder 
includes recurring items of supplementary material. Thus, the modified 
copy is practically unusable. In all cases the size of modified ITEM-2 154 
is substantially equal to the size of IP infringing ITEM-2 1 18 2 . 

It is noted that because the file size and other characteristics of 
the modified item are substantially identical with those of the IP protected 
item, a share-infringing user can not differentiate between the two items 
before and during the downloading of the modified item. The share- 
infringing user spends valuable resources to use an item which she later 
finds substantially unusable. Therefore, the share-infringing user is 
encouraged to arrange payment to the owner of the item, for downloading 
a legitimate copy of the item, or purchase a hard copy thereof. 

According to another aspect of the present invention, production 
server 150 requests translator 160 to assign a translated name for 
modified ITEM-2 154. For example, if modified ITEM-2 154 is the "Donald 
Duck in Jail" cartoon, which was produced by Walt Disney Productions in 
1966, then translator 160 assigns the name "ABC" for modified ITEM-2 
154, according to the name of the cartoon, the producer and the year of 
production. Production server 150, then replaces the characteristics of 
modified ITEM-2 154 with the name "ABC". 

User 110, before searching for the "Donald Duck in Jail" cartoon, 
which was produced by Walt Disney Productions in 1966, provides 
translator 160 the characteristics of the cartoon and requests from 
translator 160, a translated name for this cartoon. Since the characteristics 
defined by production server 150 and user 110 for the cartoon are 
identical, translator 160 supplies the same name "ABC" for this cartoon, to 
user 1 1 0. User 110 searches network 1 1 6 for the item "ABC" and directory 
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114 notifies user 110 that item "ABC" (i.e., modified ITEM-2 154) resides 
in production server 150. 

Infringing ITEM-2 118 2 is an infringing copy of the "Donald Duck 
in Jail" cartoon, which was produced by Walt Disney Productions in 1966. 
Share-infringing user 112 can request translator 160 to assign a translated 
name for infringing ITEM-2 118 2 , by providing translator 160 the 
characteristics of the cartoon. Translator 160 supplies the name "ABC" for 
this cartoon, to share-infringing user 112. Share-infringing user 112, then 
replaces the characteristics of infringing ITEM-2 118 2 with the name 
"ABC". In this case, when user 110 searches for the item "ABC" in network 
116, directory 114 notifies user 110 that one copy of item "ABC" (i.e., 
modified ITEM-2 154) resides in production server 150, and another copy 
(i.e., infringing ITEM-2 118 2 ) resides in share-infringing user 112. 

It is noted that production server 150 can initiate the production 
of mock-up copies as preemptive measures when a title is to be 
introduced to the public by the rightful owner, without searching for 
infringing copies. Furthermore, production server 150 can select a set of 
characteristics for the title, substantially identical with the characteristics 
which a share-infringing user generally selects for this type of title. For 
example, if a share-infringing user generally converts a legitimate WAV 
title of 50 Mbytes, to WAV format and in an MP3 compressed form of 3 
Mbytes, then production server 150 produces the mock-up copy in MP3 
format in a compressed form of 3 Mbytes. 

According to another aspect of the present invention, production 
server 150 can produce different sets of mock-up copies of the title, while 
initiating the preemptive action. The characteristics of mock-up copies in 
one set is different from the characteristics of mock-up copies in another 
set. For example, each of the mock-up copies of the video "Donald Duck 
in Jail" in one set has the title "Donald Duck" and is compressed to 600 
Mbytes, while each of the mock-up copies of the same video in another set 
has the title "Donald Duck in Prison" and is compressed to 100 Mbytes. 
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Share-infringing user 112 can attach a digital signature thereof, 
to infringing item 118 2 by employing a private key respective of that 
signature. Accordingly, any network user downloading infringing item 1 1 8 2 , 
shall be able to authenticate infringing item 118 2 as an item provided or 
produced by share-infringing user 112, using the public key associated 

with that signature. 

According to another aspect of the present invention, processor 
156 obtains the signature characteristics of the signature of share- 
infringing user 112 (i.e., by deciphering it from a downloaded item, by 
downloading it from the network, and the like) and attaches that signature 
to modified ITEM-2 154. Hence, any user, which downloads modified 
ITEM-2 154 shall identify it as an authentic item of share-infringing user 
112. 

Reference is now made to Figure 3, which is a schematic 
illustration of a computer system, generally referenced 200, constructed 
and operative in accordance with a further preferred embodiment of the 
present invention. System 200 includes distributed host users 206, 208 
and 210 connected to network 116. Download-infringing users 202, 204, 
share-infringing user 112 and directory 114 are connected to network 116. 
Each of distributed host users 206, 208 and 210 includes a modified 
ITEM-2 212. 

Modified ITEM-2 212 is similar to modified ITEM-2 154 (Figure 
2). ITEM-2 (not shown) is protected by intellectual property rights (e.g., 
copyright). Infringing ITEM-2 118 2 is a usable copy of ITEM-2, and 
modified ITEM-2 212 is an unusable copy of ITEM-2. When download- 
infringing user 202 searches for ITEM-2 through network 116, it detects 
four copies of ITEM-2: infringing ITEM-2 118 2) and three copies of 
modified ITEM-2 212 in each of distributed host users 206, 208 and 210. 

Directory 114 supplies download-infringing user 202 with 
information respective of the characteristics of infringing ITEM-2 118 2 and 
the three copies of modified ITEM-2 212, such as title, production date and 
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file size. Since the characteristics of infringing ITEM-2 118 2 and the three 
copies of modified ITEM-2 212 are substantially identical, download- 
infringing user 202 can not differentiate between the four items and can 
not identify the three modified (unusable) ITEM-2's 212. In this situation, 
the probability that download-infringing user 202 shall download a usable 
copy of ITEM-2 (i.e., infringing ITEM-2 118 2 ) in one try, is only l A (i.e., 
25%). 

Download-infringing user 202 can identify modified copies of 
ITEM-2 212 according to the attributes of each of the distributed host 
users 206, 208 and 210. These attributes can be network interface card 
(NIC) identification, logical user name, the network service provider, 
network protocol address, and the like. In this manner, download-infringing 
user 202 can identify infringing ITEM-2 118 2 , by elimination. Each of the 
distributed host users 206, 208 and 210 can periodically (e.g., every hour, 
once a week, or once a month), change the attributes thereof. Hence, the 
probability that download-infringing user 202 identifies the modified copies 
of ITEM-2 212, is substantially reduced. 

When sniffing user 102 (Figure 1), searches infringing ITEM-2 
1 1 8 2 in network 116, directory 114 can identify sniffing user 102 according 
to the attributes thereof, and deny access of network 116 to sniffing user 
102. Sniffing user 102 can periodically change the attributes thereof, 
thereby escaping identification by directory 1 14. 

Each of the distributed host users 206, 208 and 210 can upload 
modified ITEM-2 212 to download-infringing user 202, at the request 
thereof, while varying the Quality of Service (QoS), provided to download- 
infringing user 202, during the upload process. For example, during the 
first few minutes of transmission, distributed host user 206 can upload 
modified ITEM-2 212 to download-infringing user 202, at a high rate of 50 
kBytes/second. If, for example, the size of ITEM-2 212 is 15 Mbytes, then, 
the download should take about five minutes. Distributed host user 206 
can then reduce the transfer rate, for the remainder of modified ITEM-2 
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212, to 1 kBytes/second, thereby drastically reducing the QoS and saving 
considerable bandwidth. 

Distributed host user 206 initially uploads modified ITEM-2 212 
at a high rate, in order to convince download-infringing user 202 that the 
QoS of the connection with distributed host user 206 is high and that it can 
download ITEM-2 212 fairly rapidly. Download-infringing user 202 
continues the supposedly rapid download, only to determine at a later 
time, if at all, that the QoS of the connection has dropped considerably 
during the download of the remainder of modified ITEM-2 212. 

Distributed host user 206 lowers the transmission bit rate of 
modified ITEM-2 212, in order to balance the load thereof. In this manner, 
distributed host user 206 can simultaneously upload modified ITEM-2 212 
to download-infringing users 202 and 202 over the same high bandwidth 
channel and during high traffic periods. 

If distributed host user 206 uploads modified ITEM-2 212 at an 
initial high bit rate and subsequent low bit rate, then download-infringing 
user 202 determines during the downloading process, that modified ITEM- 
2 212 is a useless copy of ITEM-2. Download-infringing user 202 might 
identify modified ITEM-2 212 as such and terminate the remaining 
download. In order to prevent download-infringing user 202 from 
identifying modified ITEM-2 212, distributed host user 206 alternates 
between the high and the low transmission bit rates. Thus, download- 
infringing user 202 determines that the varying transmission bit rate is an 
outcome of normal variations in traffic. 

In some networks the users are requested to report the type of 
connection which links them to the network, to other nodes. A remote user 
or a server sends a bandwidth request to the user, which in turn replies 
with a bit rate value or connection type (e.g., cable, T1, T3, ISDN, 
10BaseT, 100BaseT, and the like). According to a further aspect of the 
invention, distributed host user 206 uses this mechanism to mislead 
downloading infringing users by reporting a certain bit rate, which may 
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appeal to them, and then upload files at significantly reduced bit rates, 
thereto. With respect to Figure 3, distributed host user 206 can report to 
directory 114, the type of connection thereof to network 116, via the 
downloading application. However, distributed host user 206 uploads 
modified ITEM-2 212 to download-infringing user 202 at a bit rate different 
than the one previously reported to directory 114. For example, distributed 
host user 206 can report to directory 114 that the connection thereof to 
network 116 is via a T1 trunk at 1.544 Mbits/second. However, distributed 
host user 206 uploads modified ITEM-2 212 to download-infringing user 
202 at less than one kbit/second and vice versa. 

According to another aspect of the present invention, directory 
114 is a conventional search engine, such as Yahoo!, Alta Vista, Galaxy, 
GO.COM, and the like. In this case, when download-infringing user 202 
searches for ITEM-2 using the search engine, the search result indicates 
that infringing ITEM-2 118 2 is located in share-infringing user 112 and a 
copy of modified ITEM-2 212 is located in each of distributed host users 
206, 208 and 210. 

Reference is now made to Figure 4A. Figure 4A is a schematic 
illustration of an item sharing server, generally referenced 250, 
constructed and operative in accordance with another preferred 
embodiment of the present invention. Item sharing server 250 includes a 
plurality of virtual users 252^ 252 2 and 252j and a storage unit 254. 
Storage unit 254 includes a plurality of different modified items: ITEM-1 
256 1f ITEM-2 256 2 and ITEM-Q 256 Q (Q is not necessarily equal to N of 
ITEM-N 118 N ). 

Each of virtual users 252^ 252 2 and 252j is a software 
application which runs in item sharing server 250. However, over network 
116 each of virtual users 252^ 252 2 and 252j is perceived as a hardwired 
user such as a desktop, laptop, workstation, mobile unit, network user 
applications, and the like, which has a unique URL, network protocol 
address (e.g. IP address), user name, MAC address, and the like. 
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Each of virtual users 252! , 252 2 and 252j, download-infringing 
users 202, 204, share-infringing user 112 and directory 114 are connected 
to network 116. Each of virtual users 252^ 252 2 and 252j is connected to 
storage unit 254. When download-infringing user 202 searches for ITEM-2 
(not shown), directory 114 notifies download-infringing user 202 that a 
copy of ITEM-2 is located in each of the J virtual users 252^ 252 2 and 
252j, and a copy of ITEM-2 118 2 is located in share-infringing user 112. It 
is noted that one ITEM-2 256 2 corresponds with each of the J virtual users 
252i, 252 2 and 252j. Thus, the search result lists ITEM-2 256 2 , J times, 
once for each of virtual users 252^ 252 2 and 252j, and lists ITEM-2 1 18 2 
once for share-infringing user 112. 

The characteristics of each of the J modified (unusable) ITEM- 
2's 256 2 , which supposedly resides in each of the J virtual users 252 1t 
252 2 and 252j, is identical with the characteristics of infringing (usable) 
ITEM-2 118 2 . Thus, download-infringing user 202 can not determine which 
of the items in the search result are the modified (unusable) ones. In this 
case, the probability that download-infringing user 202 downloads 
infringing (usable) ITEM-2 118 2 in the first try, is n/(n+J), where n denotes 
the number of infringing copies of ITEM-2. The greater the number of 
virtual users 252i, 252 2 and 252j, the lower the probability that download- 
infringing user 202 downloads the infringing (usable) ITEM-2 118 2 in the 
first try. 

When download-infringing user 202 searches for ITEM-1 118^ 
the search result provided by directory 1 14 indicates that one ITEM-1 118! 
resides in share-infringing user 112 and J copies of ITEM-1 256! , reside in 
each of virtual users 252-,, 252 2 and 252j. The characteristics listed in the 
search result for ITEM-1 118i is identical with the characteristics listed for 
each of the J ITEM-1's 256!. Thus, download-infringing user 202 can not 
determine which of the items are the modified (unusable) ones, only by 
cross-examining the characteristics of the items in the list. 
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The term "local user" herein below, refers to a user who 
searches for an item in a network, in order to download the item from 
another user connected to the network (herein below referred to as 
"remote user"). When a local user initiates a search for an item, the 
directory supplies a search result to the local user. The search result 
includes the characteristics of the items found, along with the URL, 
network protocol address, user name, media access control (MAC) 
address, and the like, of each of the remote users which includes an item. 
The downloading application running in the local user, initiates a "ping 
command" to the URL, network protocol address, user name, MAC 
address, and the like, of each of these remote users. When a remote user 
receives the ping command, it sends back an "ACK" signal to the local 
user. The local user application measures the time for the roundtrip from 
the instant it initiates the ping command until the time it receives the ACK 
signal and produces a "ping". The ping time provides an indication to 
quality of the connection between the ping initiating node and the ping 
destination node. Thus, in order to expedite the download procedure, the 
local user can download a selected item from the remote user having the 

lowest ping in the list. 

When the local user transmits a ping command to a remote 
user, a switched virtual connection (SVC) is established between the two 
users. When the local user initiates connection with the remote user to 
download an item, another SVC is established between the two, which can 
be different from the SVC established for transmitting the ping command. 
In this sense, the ping time indicates to the local user the download time 
from the remote user relative to other remote users, while this indication is 
true up to a certain probability. 

Since the pings for the same remote user or remote users 
located substantially close, are equal, the local user can employ the pings, 
to determine whether two or more items are located in the same remote 
user. Since virtual users 252 1f 252 2 and 252j are physically located at the 
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same site (i.e., the physical location of item sharing server 250), the pings 
of virtual users 252^ 252 2 and 252j are essentially identical, for example 
250 ms. If share-infringing user 112 is physically located at a location 
different than item sharing server 250, then the ping of share-infringing 
user 1 12 is different than the ping of virtual users 252^ 252 2 and 252j and 
it is for example, 300 ms. Download-infringing user 202 can determine that 
a plurality of J modified copies of ITEM-2 256 2 having identical pings of 
250 ms, all reside in the same user, and conclude that all of J modified 
copies ITEM-2 256 2 are indeed modified and thus unusable. Download- 
infringing user 202 can refrain from downloading any of these J modified 
copies of ITEM-2 256 2 , and instead download infringing (usable) ITEM-2 
118 2 from share-infringing user 112. Thus, when download-infringing user 
202 employs the ping command in selecting an item, she may be able to 
differentiate an infringing copy from a modified one and hence increase 
the probability for downloading a usable item. It is noted that searching 
server 100 (Figure 1), production server 150 (Figure 2) and item sharing 
server 250 (Figure 4A), or a combination thereof, can be integrated in one 
unit. 

Reference is now made to Figure 4B, which is a schematic 
illustration of an item sharing server, generally referenced 300, 
constructed and operative in accordance with a further preferred 
embodiment of the present invention. Item sharing server 300 includes a 
plurality of virtual users 302^ 302 2 and 302 L , a plurality of fixed delay units 
304i, 304 2 and 304 L and a storage unit 306. Storage unit 306 includes a 
plurality of different modified items: ITEM-1 308^ ITEM-2 308 2 and ITEM- 
P 308 P (P is not necessarily equal to N in ITEM-N 1 18 N ). 

Fixed delay unit 304! is connected to network 116 and to virtual 
user 302i. Fixed delay unit 304 2 is connected to network 116 and to virtual 
user 302 2 . Fixed delay unit 304 L is connected to network 1 16 and to virtual 
user 302 L . Virtual users 302^ 302 2 and 302 L are connected to storage unit 
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306. Download-infringing users 202, 204, share-infringing user 112 and 
directory 1 14 are connected to network 116. 

Each of fixed delay units 304! , 304 2 and 304 L is a unit which 
responds to a ping command with a delay. The delay of each of fixed 
delay units 304-I, 304 2 and 304 L is constant, but different from the rest. For 
example, the delay of each of fixed delay units 304^ 304 2 and 304 L is 45 
ms, 10 ms and 145 ms, respectively. When download-infringing user 204 
initiates a ping command to virtual user 302 1f fixed delay unit 304! applies 
a delay of 45 ms and virtual user 302i sends back an ACICi signal to 
download-infringing user 204, after a delay of 45 ms. When download- 
infringing user 204 initiates a ping command to virtual user 302 2 , fixed 
delay unit 304 2 applies a delay of 10 ms and virtual user 302 2 sends back 
an ACK 2 signal to download-infringing user 204, after a delay of 10 ms. 
When download-infringing user 204 initiates a ping command to virtual 
user 302 L , fixed delay unit 304 L applies a delay of 145 ms and virtual user 
302 L sends back an ACK L signal to download-infringing user 204, after a 
delay of 145 ms. 

Share-infringing user 112 is located at a location substantially 
different than item sharing server 300, relative to download-infringing user 
204. The ping of share-infringing user 1 12 is for example, 350 ms. 

When download-infringing user 204 searches for ITEM-2 (not 
shown), the search result provided by directory 114 indicates that one 
ITEM-2 118 2 (which is usable), resides in share-infringing user 112 and L 
copies of ITEM-2 3 08 2 , reside in each of virtual users 302! , 302 2 and 302 L . 
The characteristics listed in the search result for ITEM-2 1 1 8 2 are identical 
with the characteristics listed for each of the L copies of ITEM-2 3 08 2 . 

The downloading application running in download-infringing user 

204 indicates a ping of 295 ms for modified ITEM-2 308 2 of virtual user 

302 1( a ping of 260 ms for modified ITEM-2 308 2 of virtual user 302 2 , a 

ping of 395 ms for modified ITEM-2 308 2 of virtual user 302 L and a ping of 

350 ms for infringing ITEM-2 118 2 of share-infringing user 112. By 
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comparing the pings of virtual users 302! , 302 2 and 302 L and share- 
infringing user 112, download-infringing user 204 concludes that virtual 
users 302! , 302 2 and 302 L and share-infringing user 112 are all different 
users physically located at different locations and also that the L copies of 
modified ITEM-2 308 2 are supposedly usable. In this case, the probability 
that download-infringing user 204 downloads infringing (usable) ITEM-2 
118 2 in the first try, is n/(n+L), where n denotes the number of infringing 
copies of ITEM-2. The greater the number of virtual users 302! , 302 2 and 
302 L , the lower the probability that download-infringing user 204 
downloads the infringing (usable) ITEM-2 1 18 2 in the first try. 

Download-infringing user 204 can identify virtual users 302!, 
302 2 and 302 L as such, by analyzing the search result and determining 
that each of virtual users 302i, 302 2 and 302 L points to the same plurality 
of items (i.e., ITEM-1 308!, ITEM-2 308 2 and ITEM-P 308 P ). To circumvent 
this problem, each of virtual users 302i, 302 2 and 302 L can share a 
different set of the modified items stored in storage unit 306. For example, 
virtual user 302i shares ITEM-1 308!, ITEM-3 (not shown) and ITEM-4 
(not shown), virtual user 302 2 shares ITEM-2 3 08 2 , ITEM-9 (not shown), 
ITEM-1 1 (not shown) and ITEM-1 5 (not shown) and virtual user 302 L 
shares ITEM-20 (not shown), ITEM-29 (not shown) and ITEM-P 308 P . 

Reference is now made to Figure 5, which is a schematic 
illustration of an item sharing server, generally referenced 350, 
constructed and operative in accordance with another preferred 
embodiment of the present invention. Item sharing server 350 includes a 
plurality of virtual users 352i, 352 2 and 352 R , a random delay unit 354 and 
a storage unit 356. Storage unit 356 includes a plurality of different 
modified items: ITEM-1 358i, ITEM-2 358 2 and ITEM-S 358 s (S is not 
necessarily equal to N in ITEM-N 1 18 N ). 

Random delay unit 354 is connected to network 116 and to 
virtual users 352!, 352 2 and 352 R . Virtual users 352i, 352 2 and 352 R , are 
connected to storage unit 356. Download-infringing users 202, 204, share- 
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infringing user 112 and directory 114 are connected to network 116. 
Random delay unit 354 selects a time delay, randomly. 

When download-infringing user 202 searches for ITEM-2 (not 
shown), the search result provided by directory 114 indicates that one 
ITEM-2 118 2 , resides in share-infringing user 112 and R copies of ITEM-2 
358 2 , reside in each of virtual users 352^ 352 2 and 352 R . Download- 
infringing user 204, then initiates ping commands to share-infringing user 
112, and to virtual users 352^ 352 2 and 352 R . 

For example, when download-infringing user 202 initiates a ping 
command to virtual user 352! , random delay unit 354 randomly selects a 
time delay of 200 ms and thus virtual user 352^ sends back an "ACK/' 
signal to download-infringing user 202 after a delay of 200 ms. When 
download-infringing user 202 initiates a ping command to virtual user 352 2 , 
random delay unit 354 randomly selects a time delay of 9 ms and thus 
virtual user 352 2 sends back an "ACK 2 " signal to download-infringing user 
202 after a delay of 9 ms. When download-infringing user 202 initiates a 
ping command to virtual user 352 R , random delay unit 354 randomly 
selects a time delay of 55 ms and thus virtual user 352 R sends back an 
"ACKr" signal to download-infringing user 202 after a delay of 55 ms. 

Share-infringing user 112 is located at a location substantially 
different than item sharing server 350, relative to download-infringing user 
202. The ping of share-infringing user 112 is for example, 500 ms. By 
inspecting the ping for share-infringing user 112 and the pings for virtual 
users 352-,, 352 2 and 352 R , download-infringing user 202 concludes that 
infringing ITEM-2 1 18 2 and the R modified ITEM-2's 358 2 each resides in a 
different user. Thus, download-infringing user 202 can not determine 
which of ITEM-2 1 18 2 , and the R modified ITEM-2's 358 2 is the unmodified 
(usable) copy of ITEM-2. 

Reference is now made to Figure 6, which is a schematic 
illustration of a method for proliferating unusable copies of an item in a 

network, operative in accordance with a further preferred embodiment of 
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the present invention. In step 400, an infringing item in a network is 
identified, the infringing item is downloaded and stored in a storage unit. 
With reference to Figure 1, sniffing user 102 searches network 116 for 
infringing ITEM-2 118 2 . Directory 114 provides sniffing user 102 with a 
search result which includes ITEM-2 118 2 , sniffing user 102 identifies 
ITEM-2 118 2 as the infringing item, and determines that infringing ITEM-2 
118 2 resides in share-infringing user 112. Sniffing user 102 downloads 
infringing ITEM-2 118 2 from share-infringing user 112 and stores infringing 
ITEM-2 118 2 in a storage unit (not shown). Step 400 is described in detail 
herein below in conjunction with Figure 7. 

In step 402, a modified item, respective of the identified 
infringing item, is produced. With reference to Figure 2, processor 156 
produces modified ITEM-2 154 according to at least a portion of IP 
protected ITEM-2 158. Alternatively, processor 156 produces modified 
ITEM-2 154 according to at least a portion of infringing ITEM-2 118 2 . 
Processor 156 produces modified ITEM-2 154, such that the 
characteristics thereof (e.g., title, file size and production date) are 
substantially identical with the characteristics of infringing ITEM-2 118 2 . 
However, processor 156 produces modified ITEM-2 154 in such a manner 
that modified ITEM-2 154 can not be used the way infringing ITEM-2 118 2 
or IP protected ITEM-2 158 is generally used in its entirety. For example, 
modified ITEM-2 154 can contain the same content as of IP protected 
ITEM-2 158, while selected segments of the content are located out of 
sequence. 

A user which receives the characteristics of modified ITEM-2 
154 in a search result, can not determine that modified ITEM-2 154 is 
indeed modified and useless, by inspecting the characteristics thereof, 
alone. Neither after downloading modified ITEM-2 154 (which demands 
substantial resources such as computer time, bandwidth fees, and the 
like), can the user determine that modified ITEM-2 154 is useless. When 
the modified item is a media item (video, audio or readable files such as e- 
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books), only after starting to use a considerable portion of modified ITEM- 
2 154 does the user determine that modified ITEM-2 154 is useless. 

In step 404, a network directory is updated, respective of the 
modified item. With reference to Figure 2, production server 150 updates 
directory 114 by reporting to directory 114 the characteristics of modified 
ITEM-2 154 and the URL, network protocol address, user name, MAC 
address, and the like, of virtual user 152. 

In step 406, a plurality of virtual users are associated with the 
modified item. With reference to Figure 4B, item sharing server 300 
provides association between virtual users 302! , 302 2 and 302 L , and 
modified ITEM-2 308 2 by storing modified ITEM-2 308 2 in storage unit 306. 
An outcome of this association is that in a list included in directory 114, 
when virtual users 302i, 302 2 and 302 L are connected to network 116, 
modified ITEM-2 308 2 (including the characteristics thereof) points to each 
of virtual users 302-,, 302 2 and 302 L . Moreover, modified copies of other 
items such as modified ITEM-1 308! and modified ITEM-P 308 P are 
associated with each of virtual users 302! , 302 2 and 302 L . 

In step 408, the availability of the virtual users for downloading 
the modified item, is enabled. With reference to Figure 4B, item sharing 
server 300 connects each of virtual users 302!, 302 2 and 302 L to network 
116. Thus, other users connected to network 116, such as download- 
infringing users 202, 204 and share-infringing user 112, can download 
modified ITEM-2 308 2 and other modified items such as modified ITEM-1 
308! and modified ITEM-P 308 P . 

Reference is now made to Figure 7, which is a schematic 
illustration of step 400 of Figure 6, operative in accordance with another 
preferred embodiment of the present invention. In step 450, the 
characteristics of an IP protected item are defined. With reference to 
Figure 1, sniffing user 102 retrieves at least one of the characteristics 
(e.g., title, creation date, file size, and the like) of an IP protected item, 
from characteristics database 1 04. 
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In step 452, a search is initiated for an infringing item whose 
characteristics are similar to the IP protected item characteristics and a 
search result is produced according to the search. With reference to 
Figure 1, sniffing user 102 searches network 116 for infringing ITEM-2 
118 2 whose characteristics are similar to the characteristics of the IP 
protected item, which were defined in step 450. It is noted that directory 
114 can identify more than one infringing item whose characteristics are 
similar to the IP protected item characteristics. 

For example, if sniffing user 102 provides directory 114 with the 
title of an IP protected item, such as "Donald Duck", then the search result 
can include the items with the similar titles "Donald Duck at Sea", "Donald 
Duck in Jail" and "Donald Duck in Africa" as the putative infringing items. 
In this case, with reference to Figure 1 , "Donald Duck at Sea" is ITEM-1 
118 1f "Donald Duck in Jail" is infringing ITEM-2 118 2 and "Donald Duck in 

Africa" is ITEM-N 118 N . 

In step 454, the search result is inspected for identifying the 
infringing item and the characteristics listed in the search result, are 
retrieved. With reference to Figure 1, sniffing user 102 inspects the search 
result. The search result includes the characteristics of infringing ITEM-2 
1 182, such as the title (i.e., "Donald Duck in Jail"), the producer (i.e., "Walt 
Disney Productions"), and the type (i.e., "Video"). Sniffing user 102 
retrieves the characteristics listed in the search result, for identifying the 
infringing item, by referring for example, to characteristics database 104. 
Sniffing user 102 determines that share-infringing user 112 owns a license 
to use ITEM-1 118! and ITEM-N 118 N , but owns no license for using 
ITEM-2 11 82. Thus, sniffing user 102 determines that ITEM-2 118 2 is an 
infringing copy of ITEM-2 (i.e., "Donald Duck in Jail") and the method 
proceeds to step 456. If sniffing user 102 identifies no infringing items in 
the search result, then the method returns back to step 450, for defining 
the characteristics for a new IP protected item. 
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In step 456, the identified infringing item characteristics are 
compared with the IP protected item characteristics. With reference to 
Figure 1, sniffing user 102 compares the characteristics of ITEM-2 118 2 , 
with the characteristics of IP protected ITEM-2. The characteristics of 
5 ITEM-2 118 2 were retrieved from the search result in step 454 and the 
characteristics of IP protected ITEM-2 are retrieved from characteristics 
database 1 04. If the two characteristics do not match, then the method 
returns back to step 450, for defining the characteristics for a new IP 
protected item. 

10 If these two characteristics match, then the method can end the 

detection phase or proceed to step 458, which increases the identification 
certainty. In step 458, at least a portion of the identified infringing item is 
downloaded to a storage unit. With reference to Figure 1 , sniffing user 1 02 
downloads at least a portion of infringing ITEM-2 1 1 8 2 to a storage unit 

15 (not shown) located in searching server 100. Sniffing user 102, then stores 
the identified infringing item characteristics in a storage unit and records 
the location (i.e., the URL, network protocol address, user name, MAC 
address, and the like of share-infringing user 112) of ITEM-2 118 2 , in the 
storage unit (step 462). 

20 In step 460, the content of the identified infringing item, is 

compared with the content of the IP protected item. Many methods for 
comparing media content can be used for this step. In the example set 
forth in Figure 1, sniffing user 102 produces a content based signature for 
at least a portion of the downloaded content of infringing ITEM-2 1 18 2 , and 

25 retrieves the signature of ITEM-2 (i.e., "Donald Duck in Jail"), from 
signature database 106. Sniffing user 102, then compares the produced 
signature with the retrieved signature. If the signature of the IP protected 
ITEM-2, and the signature of infringing ITEM-2 118 2 do not match, then 
the method returns back to step 450, for defining the characteristics for a 

30 new IP protected item. If the signature of the IP protected ITEM-2, and the 
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signature of infringing ITEM-2 1 1 8 2 match, then the method proceeds to 
step 460. 

It is noted that steps 458 and 460 merely provides confirmation 
that the content of the identified infringing item is indeed infringing. Hence, 
when a low level of certainty is required, steps 458 and 460 can be 
discarded, whereby an infringing item is identified merely according to 
immediate characteristics such as item title, item size and item type. 

Reference is now made to Figure 8, which is a schematic 
illustration of a computer system, generally referenced 500, constructed 
operative in accordance with a further preferred embodiment of the 
present invention. System 500 includes a searching distributed user 502 
and a searching server 504. Searching distributed user includes a 
characteristics database 506 and a signature database 508. 

Searching distributed user is a workstation, desktop, laptop, 
mobile unit, network user applications, and the like. Searching server 504, 
characteristics database 506 and signature database 508 are similar to 
searching server 100 (Figure 1), characteristics database 104 and 
signature database 106, respectively. Characteristics database 506 and 
signature database 508 include the characteristics and the signatures, 
respectively, of selected IP protected items (not shown). Searching 
distributed user 502, searching server 504, user 110, share-infringing user 
112 and directory 1 14 are connected to network 1 16. 

Searching server 504 uploads characteristics database 506 and 
signature database 508 to searching distributed user 502, via network 116. 
Alternatively, searching server 504 delivers a hard copy of characteristics 
database 506 and signature database 508 to searching distributed user 
502, in the from of CD-ROM, floppy disk, flash memory, and the like. 

Searching distributed user 502 searches network 116 for an 
infringing copy of a selected IP protected item, for example ITEM-2 (not 
shown), according to the characteristics thereof. According to a search 
result which searching distributed user 502 receives from directory 114, 
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infringing ITEM-2 118 2 (Figure 1) resides in share-infringing user 112. 
Searching distributed user 502 downloads at least a portion of infringing 
ITEM-2 1 1 8 2 and produces a signature for infringing ITEM-2 118 2 
according to downloaded infringing ITEM-2 118 2 . Searching distributed 
user 502 retrieves the signature of IP protected ITEM-2 from signature 
database 508 and compares this signature with the produced signature of 
infringing ITEM-2 118 2 . If the two signatures match, then searching 
distributed database 502 uploads the characteristics of infringing ITEM-2 
118 2 to searching server 504, via network 116. Searching server 504, 
uploads to searching distributed user 502, an IP protected item and a 
license to use the IP protected item, as a reward for the search which 
searching distributed user 502 performs. 

Reference is now made to Figure 9, which is a schematic 
illustration of a computer system, generally referenced 550, constructed 
operative in accordance with another preferred embodiment of the present 
invention. System 550 includes a distribution server 552 and sharing 
distributed users 554 and 556. Distribution server 552 includes a storage 
unit 558. Storage unit 558 includes a plurality of modified items: modified 
ITEM-1 560-,, modified ITEM-2 154 and modified ITEM-N 560 N . Modified 
ITEM-2 154 is a modified copy of infringing ITEM-2 118 2 (Figure 1). 
Alternatively, modified ITEM-2 154 is a modified copy of IP protected 
ITEM-2 158 (Figure 2). Modified ITEM-2 154 is previously produced by 
production server 150 (Figure 2). The size of modified ITEM-2 154 is 
substantially equal to the size of infringing ITEM-2 118 2 . Sharing 
distributed users 554 and 556 are located at substantially different physical 
locations. 

Each of sharing distributed users 554 and 556 is a workstation, 
desktop, laptop, mobile unit, network user applications, and the like. 
Sharing distributed users 554 and 556, distribution server 552, user 110, 
share-infringing user 112 and directory 1 14 are connected to network 116. 
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Distribution server 552 uploads modified ITEM-2 154 to sharing 
distributed users 554 and 556, via network 116. Alternatively, distribution 
server 552 uploads modified ITEM-2 154 to sharing distributed users 554 
and 556, during an idle period (i.e., when the communication load in 
network 116 is low and the cost of bandwidth is low). Further alternatively, 
distribution server 552 uploads to sharing distributed users 554 and 556, a 
portion of the beginning of infringing ITEM-2 118 2 , and a supplementary 
material. Each of sharing distributed users 554 and 556, then produces a 
combined modified item (not shown) for infringing ITEM-2 118 2 , by 
combining the beginning portion of ITEM-2 with a plurality of the 
supplementary material, so that the size of the combined modified item is 
substantially equal to infringing ITEM-2 118 2 . Each of sharing distributed 
users 554 and 556, then stores the combined modified item in a storage 
unit therein. 

It is noted that the beginning portion of ITEM-2 and the 
supplementary material, are each in a format which allows a 
supplementary material to be linked to the beginning portion and each 
supplementary material to be linked to the previous supplementary 
material. Thus, the combined modified item is in a format known in the art, 
such as MIDI, WAV, AVI, MPEG, JPEG, ASCII, TIFF, GIF, PDF, RTF, 
bitmap, and the like, and the combined modified item can be downloaded 
from one user to another, connected to a network. 

For example, the size of ITEM-2 118 2 is 600 MB, the size of the 

beginning portion of ITEM-2 is 30 MB and the size of the supplementary 

material is 5 MB. The combined modified item, then includes the beginning 

portion of ITEM-2 118 2 (30 MB), while the remainder 570 MB thereof (600- 

30=570), includes the supplementary material recurring 114 (570/5=114) 

times. In this case, distribution server 552 uploads only 35 MB for each of 

sharing distributed users 554 and 556 to produce the combined modified 

item, instead of uploading modified ITEM-2 154 whose size is 600 MB 

(i.e., the size of infringing ITEM-2 1 18 2 ). 
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Alternatively, distribution server 552 uploads to each of sharing 
distributed users 554 and 556, a plurality of different segments of 
infringing ITEM-2 118 2 , for example, each segment having a size of 40 
MB. Distribution server 552, uploads to each of sharing distributed servers 
554 and 556, four segments of infringing ITEM-2 118 2 (a total of 160 MB), 
instead of uploading the entire modified ITEM-2 154, whose size is for 
example, 600 MB. In this case, each of sharing distributed users 554 and 
556, produces an out-of-sequence modified item (not shown), by 
repetitively combining the four segments out-of-sequence, such that the 
size of the out-of-sequence modified item is substantially equal to the size 
of infringing ITEM-2 118 2 . Each of sharing distributed users 554 and 556, 
then stores the out-of-sequence modified item in a storage unit therein. 

It is noted that each of the different segments of infringing ITEM- 
2 1 18 2 is in a format which allows one segment to be linked to the previous 
segment. Thus, the out-of-sequence modified item is in a format known in 
the art, such as MIDI, WAV, AVI, MPEG, JPEG, ASCII, TIFF, GIF, PDF, 
RTF, bitmap, and the like, and the out-of-sequence modified item can be 
downloaded from one user to another, connected to a network. 

When user 1 1 0 initiates a search for ITEM-2 1 1 8 2 (Figure 1 ) in 
network 116, directory 114 provides user 110 with a search result. The 
search result indicates that a copy of ITEM-2 118 2 resides in share- 
infringing user 112, a copy of ITEM-2 154 resides in sharing distributed 
user 554 and another copy of ITEM-2, referenced 154 resides in sharing 
distributed user 556. 

Since the characteristics of ITEM-2 118 2 and the two ITEM-2's 
154 are identical, user 110 can not determine that the two copies of ITEM- 
2 154 are modified and thus unusable. Furthermore, since the physical 
locations of share-infringing user 112 and sharing distributed users 554 
and 556 are different, the pings of these users are different. Thus, user 
110 can not determine which of ITEM-2's 118 2 and 154 are modified and 
unusable, by examining the characteristics and pings thereof, alone. 
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When user 110 transmits a request for example, to sharing 
distributed user 554 to download modified ITEM-2 154 therefrom, then 
sharing distributed user 554 uploads to user 110 modified ITEM-2 154, 
which distribution server 552 had previously uploaded to sharing 
distributed user 554. Alternatively, sharing distributed user 554 uploads to 
user 110 the combined modified item, from the storage unit therein. 
Further alternatively, sharing distributed user 554 uploads to user 110 the 
out-of-sequence modified item, from the storage unit therein. 

Alternatively, sharing distributed user 554 uploads to user 1 1 0 
the beginning portion of infringing ITEM-2 118 2 and then a selected 
number of the supplementary material, such that the amount of uploaded 
data is substantially equal to the size of infringing ITEM-2 118 2 . 
Alternatively, sharing distributed user 554 uploads to user 110 a selected 
number of the different segments of infringing ITEM-2 118 2l out-of- 
sequence, such that the amount of uploaded data is substantially equal to 
the size of infringing ITEM-2 118 2 . 

Further alternatively, sharing distributed user 554 uploads the 
different segments of infringing ITEM-2 118 2 , out-of-sequence, for as long 
as user 110 is connected to sharing distributed user 554 via network 116 
and for as long as the downloading application is running in both user 1 1 0 
and sharing distributed user 554. Alternatively, when user 110 opens 
infringing ITEM-2 118 2 , infringing ITEM-2 118 2 runs properly during the 
beginning portion thereof, but ceases to run thereafter, or runs improperly 
thereafter. 

Further alternatively, when sharing distributed user 554 uploads 
modified ITEM-2 154 to user 110, sharing distributed user 554 determines 
the e-mail address of user 110 according to the user name thereof. 
Sharing distributed user 554 then sends an e-mail message to user 110. 
In this e-mail message, sharing distributed user 554 notifies user 110 that 
it has infringed IP protected rights, reports the means by which user 110 



-39- 



can obtain a legitimate of infringing ITEM-2 118 2 , posts an advertisement, 
a commercial promotion, and the like. 

According to another aspect of the present invention, other 
sharing distributed users (not shown), can be connected to each of 
sharing distributed users 554 and 556, via Internet Protocol (IP) 
multicasting. Each of sharing distributed users 554 and 556 uploads 
modified ITEM-2 154 to each of these other sharing distributed users 
connected thereto. Thus, the number of the sharing distributed users 
which include modified ITEM-2 154 can be increased considerably, at a 
relatively low bandwidth cost. Furthermore, periodically, for example once 
a year, distributed server 552 deletes those modified items from each of 
sharing distributed users 554 and 556, which are no longer being 
downloaded with sufficient frequency, by user 110 or share-infringing user 
112. 

Reference is now made to Figure 10, which is a schematic 
illustration of a computer system, generally referenced 600, constructed 
operative in accordance with a further preferred embodiment of the 
present invention. System 600 includes a plurality of repositories 602!, 
602 2 and 602 T , an addressing server 610 and a plurality of pseudo-sharing 
users 604 and 606. Repositories 602!, 602 2 and 602 T , pseudo-sharing 
users 604 and 606, addressing server 610, user 110, download-infringing 
user 202 and directory 114 are connected to network 116. It is noted that 
repositories 602!, 602 2 and 602 T include internal network interfaces (not 
shown) for connecting to network 116. 

The term "peer brokering " herein below, refers to a method by 
which a first user connected to a network, provides connection between a 
second user and a third user via the network, when the second user 
connects to the first user. The first user, then tears down its connection 
with the second user, and instead connects the second user with the third 
user. The second user perceives that it is communicating with the first 
user, while the second user is actually communicating with the third user. 
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Each of pseudo-sharing users 604 and 606 is a workstation, 
desktop, laptop, mobile unit, network user applications, and the like. Each 
of pseudo-sharing users 604 and 606 includes a peer brokering function. 
Each of pseudo-sharing users 604 and 606 includes a list of modified 
items (not shown). Each of repositories 602^ 602 2 and 602 Tl includes the 
content of all or a portion of the modified items listed in each of pseudo- 
sharing users 604 and 606. Addressing server 610 includes a 
characteristics list of all the modified items which are located in 
repositories 602! , 602 2 and 602 T . Each entry in the characteristics list 
includes a pointer to the specific location in the repository which includes 
the content of the modified item recorded in the entry. 

When download-infringing user 202 searches for a selected item 
in network 116, directory 114 provides download-infringing user 202 with a 
search result. The modified items list of pseudo-sharing user 604 includes 
the selected item. Therefore, the search result indicates that the selected 
item resides in pseudo-sharing user 604. By running the downloading 
application, download-infringing user 202 establishes connection with 
pseudo-sharing user 604 and initiates a request to download the selected 
item from pseudo-sharing user 604. 

The following is a peer brokering scenario according to another 
aspect of the invention. Download-infringing user 202 transmits a request 
message to pseudo-sharing user 604 to download an item. In return, 
pseudo-sharing user 604 directs download-infringing user 202 to one of 
repositories 602! , 602 2 and 602 T , for downloading the requested item 
therefrom. It is noted that this directing procedure is seamless to 
download-infringing user 202. 

Pseudo-sharing user 604 transmits a peer brokering message to 
addressing server 610 and tears down its connection with download- 
infringing user 202. This peer brokering message includes the network 
address of download-infringing user 202 and the characteristics of the 
requested item. According to the characteristics list, addressing server 610 
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determines that a modified copy of the requested item is located for 
example, in repository 602i. Addressing server 610 transmits a message 
to download-infringing user 202 to establish connection with repository 
602! (e.g., via a link 608) and another message to repository 602^ to 
respond to download-infringing user 202. Furthermore, addressing server 
610 instructs repository 602! to upload the modified version of the 
requested item to download-infringing user 202. Download-infringing user 
202 downloads the modified version of the requested item from repository 
602^ but download-infringing user 202 perceives that it is downloading the 
modified item from pseudo-sharing user 604. In this manner, pseudo- 
sharing users 604 and 606 operate as "agents" on behalf of repositories 
602i, 602 2 and 602 T , while consuming substantially small computer 
resources, such as bandwidth and memory. 

It will be appreciated by persons skilled in the art that the 
present invention is not limited to what has been particularly shown and 
described herein above. Rather the scope of the present invention is 
defined only by the claims, which follow. 
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